@cello-protocol/daemon 0.0.40 → 0.0.42

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAkqL7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EAQrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAQ/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAQ/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AA2CD,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAktL7E"}

package/dist/daemon.js

@@ -4117,6 +4117,7 @@ export async function startDaemon(config) {
             participantAPubkeyHex,
             participantBPubkeyHex,
             initiatorPeerId: typeof a["initiator_session_peer_id"] === "string" ? a["initiator_session_peer_id"] : "",
+            counterpartySessionPeerId: typeof a["counterparty_session_peer_id"] === "string" ? a["counterparty_session_peer_id"] : null,
             sessionTimestamp: typeof a["session_timestamp"] === "number" ? a["session_timestamp"] : 0,
             signatureType: typeof a["signature_type"] === "string" ? a["signature_type"] : null,
             // M7 legibility-TBS-binding (responder verify): the FROST-signed assignment embeds the
@@ -4321,6 +4322,22 @@ export async function startDaemon(config) {
             });
             return;
         }
+        // DOD-INBOUND-GUARD-1 (D3): the receive-side mirror of the initiator's F13 guard (~3189).
+        // An empty counterparty endpoint means the offer-accept never happened (this agent's standing
+        // receiver was not up when the directory's session_offer arrived) and the directory signed the
+        // assignment anyway, with "empty defaults". The initiator refuses that assignment and creates
+        // NO session — accepting it here builds a phantom session whose away-reply lands in the
+        // initiator's transcript with no session row: permanently unread AND unreadable. Refuse it
+        // loudly, before any session state exists. Nothing legitimate is lost — a session whose
+        // initiator has no address to dial is unusable by construction.
+        if (!parsed.counterpartySessionPeerId) {
+            logger.warn("session.inbound.assignment.incomplete", {
+                agentName: localAgent.name,
+                sessionId: parsed.sessionIdHex,
+                correlationId,
+            });
+            return;
+        }
         // M1: idempotency — a retransmitted assignment for an already-known session (persisted
         // row OR currently in flight) must not double-accept (orphaned node) or double-enqueue.
         if (inboundInFlight.has(parsed.sessionIdHex) || sessionNodeManager.getSessionRecord(localAgent.name, parsed.sessionIdHex)) {
@@ -5151,12 +5168,22 @@ export async function startDaemon(config) {
             return { ok: false, reason: "missing_params", guidance: "Provide 'session_id' (hex) to receive content for a specific session." };
         }
         const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
+        // DOD-UNREAD-1 D4b: a TRANSCRIPT-ONLY session — received rows exist but no sessions row (the
+        // pre-D3/D4a phantom residue: the counterparty's reply landed while this side refused the
+        // session). Those rows are counted unread by getUnreadSummary, so cello_receive MUST be able
+        // to read them or the badge can never clear. Reading is a transcript operation: the since_seq
+        // catch-up below works from the durable transcript alone. Only a session with NEITHER a row
+        // NOR transcript rows is truly not found.
+        let transcriptOnly = false;
         if (!record) {
-            return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_list_sessions." };
-        }
-        if (record.agent_name !== agentName) {
-            return { ok: false, reason: "session_not_owned", guidance: "This session belongs to a different agent. Call cello_use_agent to switch to the agent that owns it, then retry." };
+            if (sessionNodeManager.readTranscript(agentName, sessionId).messages.length === 0) {
+                return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_list_sessions." };
+            }
+            transcriptOnly = true;
         }
+        // (D4 review F3: the old `record.agent_name !== agentName` → session_not_owned branch was dead
+        // code — getSessionRecord is keyed by (agent_name, session_id), so a record can never belong to
+        // a different agent. A cross-agent session id simply has no record under this agent.)
         // M8C-SINCESEQ-1: stateless catch-up. When since_seq is provided, return a BATCH of received
         // transcript messages with sequence > since_seq (durable transcript, not the ephemeral buffer —
         // so concurrent arrivals don't shift what a given since_seq returns; no replay race). Replaces
@@ -5166,7 +5193,9 @@ export async function startDaemon(config) {
         const rawSince = params?.since_seq;
         if (typeof rawSince === "number" && Number.isFinite(rawSince)) {
             const sinceSeq = rawSince;
-            const from = record.counterparty_pubkey;
+            // D4b AC2: a transcript-only session has no record to attribute from — `from` is null,
+            // NEVER the string "unknown" (the transcript stores no counterparty; don't invent one).
+            const from = record ? record.counterparty_pubkey : null;
             const { messages } = sessionNodeManager.readTranscript(agentName, sessionId);
             const received = messages.filter((m) => m.direction === "received" && m.sequence > sinceSeq);
             if (received.length > 0) {
@@ -5187,6 +5216,17 @@ export async function startDaemon(config) {
                 messages: received.map((m) => ({ sequence: m.sequence, content: m.text, from })),
             };
         }
+        // D4b AC3: the plain (blocking) receive waits on a LIVE session's buffer — a transcript-only
+        // session has no live node and nothing will ever arrive. Waiting to a null timeout would be
+        // misleading and session_not_found would be a lie (the transcript exists). A distinct reason
+        // points the caller at the read that works.
+        if (transcriptOnly) {
+            return {
+                ok: false,
+                reason: "session_not_live",
+                guidance: "This session exists only as a durable transcript (no live session — it was never established or predates this daemon). Read it with cello_receive { since_seq } (e.g. since_seq: -1 for everything) or cello_get_transcript.",
+            };
+        }
         const rawTimeout = params?.timeout_ms;
         const timeoutMs = typeof rawTimeout === "number" && Number.isFinite(rawTimeout) && rawTimeout >= 0
             ? rawTimeout